VulnSocial

CVE-2026-6516Disclosure

LOWCVSS 10.0 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 16 mentions across 7 observed days
  • Momentum state: declining

What's happening

  • PoC mentioned or linked in 2 signals
  • Patch or workaround mentioned in 5 signals
  • Technical details provided in 12 signals
  • Disclosure: 6 classified signals
  • General: 3 classified signals
  • Peaked 6d ago at 7 mentions (2026-07-24); latest day: 1
  • 16 total mentions across 7 days

Deep dive

Activity timeline16 mentions / 7d
02457Mentions · 2026-07-24: 7Mentions · 2026-07-27: 3Mentions · 2026-07-29: 2Mentions · 2026-07-30: 1Mentions · 2026-07-31: 1Mentions · 2026-08-13: 1Mentions · 2026-09-01: 1PoC Mentioned / Linked · 2026-07-29: 2Patch / Workaround · 2026-07-24: 4Patch / Workaround · 2026-07-27: 1Technical Details · 2026-07-24: 6Technical Details · 2026-07-27: 3Technical Details · 2026-07-30: 1Technical Details · 2026-07-31: 1Technical Details · 2026-08-13: 107-2407-2707-2907-3007-3108-1309-01
Signal classification4 categories
Disclosure
637.5%
Patch
531.3%
General
318.8%
PoC
212.5%
Referenced assets11 URLs
By indicator
Classification over time
DateTotalLabels
2026-07-247
Disclosure3General1Patch3
2026-07-273
Disclosure2Patch1
2026-07-292
PoC2
2026-07-301
General1
2026-07-311
Disclosure1
2026-08-131
Patch1
2026-09-011
General1
Full discourse16 posts
  • FOFA@fofabot
    Disclosure

    ⚠️⚠️ CVE-2026-6516 (CVSS 10.0): ManageEngine ADAudit Plus Agent API auth bypass + path traversal chain to unauthenticated RCE (builds <8606). 🔗FOFA Link: https://en.fofa.info/result?qbase64=dGl0bGU9ImFkYXVkaXQi 🎯2.4K+ Results are found on http://en.fofa.info in the past year. FOFA Query: title="ADAudit" 🔖Refer: https://securityonline.info/adaudit-plus-cve-2026-6516/ #OSINT #FOFA #CyberSecurity #Vulnerability

    Post summary

    The text discloses CVE-2026-6516, including its CVSS score and technical details of an unauthenticated RCE via an auth bypass and path traversal chain, without mentioning a PoC, exploit, or patch.

    01303292.9K
    14.8K followersView on X
  • ZoomEye@zoomeye_team
    Disclosure

    🚨 CVE-2026-6516: Remote Code Execution Critical Vulnerability Alert! ADAudit is affected by CVE-2026-6516. Full Vulnerability Details & Analysis at DarkEye: 🔗 https://darkeye.org/vuln/cve/CVE-2026-6516 🔍 Identify Targets via ZoomEye: Filter: vul.cve="CVE-2026-6516" Search Dork: title="ADAudit" Exposure: 6.6k instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=dGl0bGU9IkFEQXVkaXQi&t=all&utm_source=twitter&utm_medium=social&utm_campaign=cve_ops_20260727 #Infosec #CyberSecurity #ZoomEye #DarkEye

    Post summary

    The tweet announces the discovery of CVE‑2026‑6516, a remote code execution vulnerability affecting ADAudit, and points to a detailed analysis page, but it does not mention PoC, exploit code, active attacks, or patches.

    04021104.4K
    12.7K followersView on X
  • Horizon3.ai@Horizon3ai
    PoC

    🚨 Identity infrastructure is under attack again. Rapid Response test now available for CVE-2026-6516 in ManageEngine ADAudit Plus. https://t.co/HRzNLfvLzs

    Post summary

    The tweet indicates that Rapid Response has released a test (likely a PoC) for CVE-2026-6516, but it does not provide technical details, exploit code, or evidence of active exploitation.

    13131281
    2.9K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    ManageEngine fixed an ADAudit Plus vulnerability, CVE-2026-6516, a CVSS 10 unauthenticated remote code execution flaw. Update to build 8606 now. #ADAuditPlus #ManageEngine #CVE20266516 #RCE #ActiveDirectory #PatchNow http://securityonline.info/adaudit-plus-cve-2026-6516/

    Post summary

    ManageEngine has released a patch for the CVSS 10 RCE vulnerability CVE‑2026‑6516; users should update to build 8606 immediately.

    00113933
    12.6K followersView on X
  • YogSotho@YogSoth0
    General

    @remixedcat @DarkWebInformer Yeah and now you can be rooted more easily CVE-2026-6516 😂

    Post summary

    The tweet only names CVE‑2026‑6516 and notes it can be exploited for root access, without further technical details, PoC, exploit code, or mitigation information.

    0001040
    1.9K followersView on X
  • Stanislav Klevtsov@stansecure
    Patch

    Top #CVE to #patch this week 👀 - @VMware #ESXi 9.0 RCE (CVE-2026-47876, CVE-2026-41703) - @JetBrains #TeamCity RCE (CVE-2026-63077, CVE-2026-65907) - #Jenkins Core (CVE-2026-70426) - @zohocorp ManageEngine ADAudit RCE (CVE-2026-6516) - @IBM Langflow RCE (CVE-2026-9198) - @ApacheKylin OS command injection (CVE-2026-62392) - #MOVEit auth bypass (CVE-2026-4670) - @giteaio unauth file read (CVE-2026-59774)

    Post summary

    The tweet lists multiple CVEs and encourages patching them soon, but it does not provide any detailed exploit information, PoCs, or references to specific patches.

    1000073
    44 followersView on X
  • Kaitan ID Security@KaitanSecurity
    Disclosure

    🎯 Zohocorp ManageEngine ADAudit Plus — Unauthenticated RCE (CVSS 10.0) CVE-2026-6516 is the headline vulnerability this week. ManageEngine ADAudit Plus versions before 8606 expose a vulnerable agent API that allows unauthenticated remote code…

    Post summary

    CVE‑2026‑6516 is an unauthenticated remote code execution flaw in ManageEngine ADAudit Plus affecting versions before 8606, with a CVSS score of 10.0; no exploit code or active exploitation is reported, and no patch or workaround is referenced.

    1000047
    87 followersView on X
  • CVE Brief@DailyCVEBrief
    Patch

    DEEP DIVE — CVE-2026-6516: unauthenticated RCE in ManageEngine ADAudit Plus (CVSS 10.0, no auth). Any server on a build below 8606 is exploitable, and it sits inside your AD trust boundary with a privileged service account. Patch check inside. https://t.co/fOZNFZwBtA

    Post summary

    A high‑severity, unauthenticated remote code execution vulnerability (CVE‑2026‑6516) affects ManageEngine ADAuditenter, and the tweet points to a patch within the linked content.

    1000076
    22 followersView on X
  • NotCVE@notCVE
    General

    🎯 Most likely to be exploited next (EPSS): • CVE-2026-6516 — EPSS 4.7% · CVSS 10 • CVE-2026-47668 — EPSS 4.3% · CVSS 10 • CVE-2026-17191 — EPSS 2.8% · CVSS 9.1 📄 Full weekly tables → https://github.com/notcve/reports/blob/main/weekly/2026-07-30.md

    Post summary

    The post lists three CVEs with EPSS and CVSS metrics but contains no PoC, exploit code, active exploitation claim, or patch information.

    0000049
    62 followersView on X
  • Horizon3.ai@Horizon3ai
    PoC

    👉 Run the #NodeZero Rapid Response test to validate exploitability and confirm remediation: https://horizon3.ai/attack-research/vulnerabilities/cve-2026-6516/?utm_source=twitter&utm_medium=social

    Post summary

    The post encourages running the NodeZero Rapid Response test to verify the exploitability of CVE‑2026‑6516 and to confirm remediation status.

    0000082
    2.9K followersView on X
  • Autumn Good@autumn_good_35
    Patch

    🚨🚨 4月にサイレント修正 『An unauthenticated adversary could combine these vulnerabilities to potentially achieve remote code execution』 Unauthenticated Remote Code Execution Vulnerability (CVE-2026-6516) fixed in build 8606 | ManageEngine ADAudit Plus https://www.manageengine.com/products/active-directory-audit/cve-2026-6516.html

    Post summary

    The post announces a silent fix (build 8606) for an unauthenticated RCE vulnerability (CVE‑2026‑6516) in ManageEngine ADAudit Plus, providing the fix but no PoC or exploit details.

    00000435
    7.0K followersView on X
  • 𝔸𝕟𝕠𝕟𝕪𝕞𝕠𝕦𝕤 ℍ𝕒𝕔𝕜𝕥𝕚𝕧𝕚𝕤𝕥☭⃠🅇@YourAnon_irc
    Disclosure

    Critical RCE (CVE-2026-6516) in Zoho ManageEngine ADAudit Plus (Jul 23, 2026, 18:17 UTC) allows unauthenticated remote execution. High risk to data privacy &amp; integrity in transit. #Cybersecurity #Anonymous #News

    Post summary

    A new critical RCE vulnerability (CVE-2026-6516) in Zoho ManageEngine ADAudit Plus allows unauthenticated remote code execution, posing high risk to data privacy and integrity.

    0000068
    16 followersView on X
  • CVE Brief@DailyCVEBrief
    General

    Full Deep Dive — am-I-vulnerable check, threat model, starter YARA + Sigma rules: https://cvebrief.com/cve/CVE-2026-6516/ https://t.co/J2rgY2GKqS

    Post summary

    The tweet links to a deep‑dive article on CVE‑2026‑6516 providing threat model and detection rules, but offers no PoC, exploit code, patch, or technical vulnerability details.

    0000057
    22 followersView on X
  • CCB Alert@CCBalert
    Patch

    Warning: CVE-2026-6516 is a Unauthenticated Remote Code Execution #RCE vulnerability in Zohocorp ManageEngine ADAudit Plus. Update to version 8606 or newer! More info in the manufacturer advisory: https://www.manageengine.com/products/active-directory-audit/cve-2026-6516.html #Patch #Patch #Patch

    Post summary

    The advisory confirms a Remote Code Execution vulnerability in ManageEngine ADAudit Plus and directs users to update to version 8606 or newer.

    00000309
    7.2K followersView on X
  • SystemTek - Technology news website@SystemTek_UK
    Disclosure

    Zohocorp Unauthenticated Remote Code Execution Vulnerability (CVE-2026-6516)  https://www.systemtek.co.uk/2026/07/zohocorp-unauthenticated-remote-code-execution-vulnerability-cve-2026-6516/ via @SystemTek_UK

    Post summary

    A newly disclosed unauthenticated remote code execution vulnerability, CVE-2026-6516, has been announced. No proof‑of‑concept, exploit, patch, or active exploitation details are provided.

    0000077
    1.8K followersView on X
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨 CRITICAL - Unauthenticated OS Command Injection RCE via Agent API (CVE-2026-6516) CVE-2026-6516 is an unauthenticated remote code execution vulnerability in the agent API component of Zohocorp ManageEngine ADAudit Plus. The root cause is OS command injection due to improper input validation/unsafe command construction when handling agent API requests. An attacker can exploit this remotely by sending crafted requests to the exposed agent API endpoint with no credentials required. Successful exploitation enables arbitrary command execution on the ADAudit Plus server, leading to full system compromise, data theft, lateral movement, and potential domain-wide impact. 👉 Affected: ManageEngine ADAudit Plus < 8606 | Upgrade to 8606

    Post summary

    The post announces CVE-2026-6516, an unauthenticated OS command injection RCE in ManageEngine ADAudit Plus, and recommends upgrading to version 8606 as the remedy.

    00000118
    254 followersView on X

Explore more

Back to dashboard